SSL/TLS certificates encrypt data transmitted between your website and visitors, protecting sensitive information like passwords and credit card details. Modern hosting platforms support TLS 1.2 and TLS 1.3 protocols, with TLS 1.2 enabled by default to ensure maximum compatibility and security for all websites.
This guide covers everything you need to know about managing SSL/TLS certificates, including how to generate private keys, create certificate signing requests, and install certificates on your domains.
What Is SSL/TLS?
SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols that create secure connections between web servers and browsers. While SSL is the older term, TLS is the modern standard. When you see "SSL certificate," it typically refers to a TLS certificate.
These certificates serve three primary purposes:
- Encrypting data transmitted between your website and visitors
- Authenticating your website's identity to prevent impersonation
- Building visitor trust through visible security indicators like the padlock icon
Every website that handles sensitive information should use SSL/TLS encryption. Search engines like Google also favor HTTPS-enabled websites in search rankings.
Supported TLS Protocol Versions
OBHost supports modern TLS protocol versions to ensure your website meets current security standards:
- TLS 1.2: Enabled by default and supported by virtually all modern browsers and devices
- TLS 1.3: The newest protocol version offering improved security and performance, requires OpenSSL 1.1.1 or higher
Older protocols like SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 are not supported due to known security vulnerabilities. This ensures your website maintains the highest security standards.
Understanding CAA Records
CAA (Certificate Authority Authorization) records are DNS entries that specify which Certificate Authorities can issue certificates for your domain. These records add an extra layer of security by preventing unauthorized certificate issuance.
Here's how CAA records work:
- If no CAA records exist for your domain, any Certificate Authority can issue certificates
- If CAA records exist, only the specified Certificate Authorities can issue certificates
- You can add multiple CAA records to authorize several Certificate Authorities
A typical CAA record looks like this:
example.com. 86400 IN CAA 0 issue "certificateauthority.com"
You can manage CAA records through your hosting control panel's DNS zone editor. If you need to add or modify CAA records, ensure they match the Certificate Authority you plan to use for your SSL/TLS certificates.
SSL/TLS Management Features
Modern hosting control panels provide comprehensive tools for managing SSL/TLS certificates. Here are the key features you'll typically find:
Default SSL/TLS Key Type
This setting determines which cryptographic key type the system uses when generating new certificates and signing requests. Common options include RSA and ECDSA keys. Changing this setting affects all future certificate generations and may trigger automatic certificate renewals to update existing certificates.
Private Keys (KEY)
Private keys are the secret component of your SSL/TLS certificate. They work with the public certificate to encrypt and decrypt data. You can:
- Generate new private keys with different key sizes
- View existing keys stored on your account
- Upload keys generated elsewhere
- Delete keys you no longer need
Keep private keys secure and never share them. If a private key is compromised, you must revoke the associated certificate and generate a new one.
Certificate Signing Requests (CSR)
A CSR is a file containing information about your organization and domain that you submit to a Certificate Authority. The CA uses this information to generate your SSL/TLS certificate. You can:
- Generate new CSRs for certificate purchases
- View pending CSRs
- Delete CSRs after you receive your certificate
SSL/TLS Certificates (CRT)
This is where you manage the actual certificates that secure your domains. Features include:
- Installing purchased certificates from external Certificate Authorities
- Generating self-signed certificates for testing
- Viewing certificate details including expiration dates
- Removing old or expired certificates
Install and Manage SSL for Your Site (HTTPS)
This unified interface lets you install and configure SSL/TLS certificates for specific domains. You can upload certificate files, paste certificate text, or use automatically generated certificates, depending on your hosting provider's features.
How to Generate an SSL/TLS Certificate
The process of obtaining an SSL/TLS certificate typically follows these steps:
- Generate a private key: Create a new private key using your preferred key type and size
- Create a CSR: Generate a certificate signing request containing your domain and organization information
- Submit to Certificate Authority: Send the CSR to a CA for validation and certificate issuance
- Install the certificate: Upload the issued certificate and configure it for your domain
Many hosting providers now offer automated certificate management that handles these steps automatically, making HTTPS setup effortless.
Best Practices for SSL/TLS Management
Follow these recommendations to maintain strong website security:
- Monitor expiration dates: Set up reminders to renew certificates before they expire
- Use strong key sizes: Choose at least 2048-bit RSA keys or 256-bit ECDSA keys
- Keep software updated: Ensure your server runs current versions of OpenSSL and other security software
- Configure CAA records: Add CAA records to prevent unauthorized certificate issuance
- Test your configuration: Use SSL testing tools to verify proper certificate installation and configuration
- Implement HSTS: Enable HTTP Strict Transport Security to force HTTPS connections
- Backup private keys:
Frequently Asked Questions
What's the difference between SSL and TLS?
SSL (Secure Sockets Layer) is the older protocol, while TLS (Transport Layer Security) is the modern replacement. TLS 1.2 and 1.3 are the current standards. The terms are often used interchangeably, but when you see "SSL certificate" today, it's actually a TLS certificate using modern protocols.
Why did my certificates automatically update after changing the default key type?
When you change your preferred SSL/TLS key type, the system triggers an automatic certificate renewal process to update all existing certificates to use the new key type. This ensures consistency across all your domains and takes advantage of the security characteristics of your chosen key type.
Can I use the same certificate on multiple domains?
You can use a single certificate for multiple domains by obtaining either a multi-domain (SAN) certificate or a wildcard certificate. Multi-domain certificates list specific domains in the Subject Alternative Name field, while wildcard certificates cover all subdomains of a single domain (like *.example.com).
What should I do if my private key is compromised?
If you suspect your private key has been compromised, immediately revoke the associated certificate through your Certificate Authority, generate a new private key and CSR, obtain a new certificate, and install it on your server. Update any backups to remove the compromised key.
OBHost's support team is available 24/7 to assist with SSL/TLS certificate installation and troubleshooting. Visit https://www.obhost.net/contact or email support@obhost.org for technical assistance.
